Query live WHOIS databases to retrieve ownership, registrar, nameservers, expiry dates, and status codes for domains, IPv4/IPv6 addresses, and Autonomous System Numbers (ASN).
WHOIS (pronounced "who is") is a query/response protocol used to access databases that store the registration information of internet resources — domain names, IP address blocks, and Autonomous System Numbers (ASNs). Originally standardized in RFC 812 (1982) and later updated by RFC 3912, it remains a cornerstone of internet transparency and cybersecurity.
Protocol basics
Client → TCP port 43 → WHOIS server → plain text response
Example: `whois google.com` on a Linux terminal connects to the appropriate server and returns registration details.
Our PHP implementation: The backend opens a socket to the correct WHOIS server (e.g., whois.verisign-grs.com for .com), sends the query, and streams the response back to you – exactly like the command line.
WHOIS was developed in the early 1980s by the ARPANET Network Information Center (NIC) at SRI International. For decades, it provided public access to registrant names, postal addresses, phone numbers, and emails. However, the European Union's General Data Protection Regulation (GDPR) in 2018 forced registrars to redact most personal data. Today, many records show "Redacted for privacy". In response, the internet community developed RDAP (Registration Data Access Protocol) as a modern replacement with standardized JSON output and tiered access, though WHOIS is still widely used.
Why PHP backend? Running WHOIS queries client‑side is impossible due to browser restrictions (cannot open raw TCP port 43). Our server acts as a proxy, performing the query and returning the raw text. This mirrors the traditional `whois` command experience while keeping your interaction private.
Depending on the resource and registrar, a WHOIS record typically contains:
| Category | Examples | Notes |
|---|---|---|
| Domain | Domain name, registrar, registry domain ID | e.g., "MARKMONITOR, INC." |
| Key dates | Creation, expiration, last updated | Critical for renewal and monitoring |
| Nameservers | ns1.google.com, ns2.google.com | DNS resolution delegation |
| Status codes | clientTransferProhibited, serverHold | ICANN status meanings |
| Contacts | Registrant, admin, tech, abuse | Often redacted post‑GDPR |
| IP/ASN | Net range, organisation, country, origin AS | From RIRs like ARIN, RIPE, APNIC |
Registrar – The ICANN‑accredited company where the domain was registered (e.g., GoDaddy, Namecheap).
Creation/Expiry dates – Usually in UTC (ISO 8601 format). Expiry is critical: domains typically enter a grace period (auto‑renew), then redemption, then become available for re‑registration.
Nameservers – At least two DNS servers that resolve the domain.
Status codes – clientTransferProhibited means the domain is locked to prevent unauthorized transfer. serverHold often indicates suspension.
A security analyst receives a suspicious email from "paypa1-security.com". Using this WHOIS tool, they discover the domain was registered 2 days ago with a privacy-protected registrant. The registrar is identified as "NAMECHEAP, INC." The analyst immediately sends an abuse report to [email protected] (found in the registrar's WHOIS) and provides the creation date as evidence. Within 24 hours, the domain is suspended. This highlights how WHOIS data aids rapid incident response.
Since May 2018, GDPR mandates that personal data of EU citizens be protected. Registrars now redact registrant names, emails, and phones, replacing them with proxy services or placeholders. To contact a domain owner, you generally must use a web form or send mail to the registrant's proxy email. This tool reflects the same redacted data you would see on a terminal.
[email protected]) or a form. For IP addresses, abuse contact emails are often still visible.